Information Commissioner’s Office launches consultation on Generative AI

The Information Commissioner’s Office (“ICO”) has launched a series of consultations on how UK data protection law should apply to the development and use of Generative AI models.

What is meant by Generative AI?

Generative AI refers to models of artificial intelligence (“AI”) that can create new content, including images, videos, high-quality text, audio or computer code. They are trained on extensive amounts of raw data (or “datasets”) which allow them to generate new content for a variety of use cases. 

Why are consultations needed?

The ICO notes that its recent engagement with technology and AI innovators has drawn out a variety questions raised by organisations, concerning the application of data protection law in this area. Examples include:

  • What are the expectations in terms of complying with data subject rights?
  • What is the appropriate lawful basis for training generative AI models?
  • What are the expectations around complying with the accuracy principle?

A series of consultations

The consultations are being launched by the ICO in a series of “chapters”, with the first chapter addressing the lawful basis for training generative AI models on web-scraped data (a process of gathering and/or extracting data from websites and exporting that data into a structured format). This chapter aims to assess, in particular, whether or not legitimate interests can be relied on as a valid lawful basis for training Generative AI models, where the developer of a Generative AI model takes their legal obligations seriously and can demonstrate that they are able to pass the requisite three-part test. In doing so, the developer must be able to demonstrate that:

  1. the purpose of the processing is legitimate;
  2. the processing is necessary for that purpose; and
  3. the individual’s interests do not override the interest being pursued.

Our views

The first consultation opened in mid-January and is due to end on 1 March 2024. Interested organisations are able to provide feedback on the first chapter by completing a survey (which can be found here) or by e-mailing the ICO. Whilst the ICO has not confirmed in certainty whether it will publish a summary of responses, we expect to see an outcome of this consultation in due course.

Read the other topical articles from our Winter Data Protection Update:

Get in touch

The content of this page is a summary of the law in force at the date of publication and is not exhaustive, nor does it contain definitive advice. Specialist legal advice should be sought in relation to any queries that may arise.

Related expertise

Get in touch

Contact us today

Whatever your legal needs, our wide ranging expertise is here to support you and your business, so let’s start your legal journey today and get you in touch with the right lawyer to get you started.


Get in touch

For general enquiries, please complete this form and we will direct your message to the most appropriate person.